Wireshark capture filter

Show body

Ciro Santilli 34 Updated 2024-11-19 Created 1970-01-01

Capture by instead:

sudo wireshark -f http -k
sudo wireshark -f icmp -k

Filter by both protocol and host:

sudo wireshark -f 'host 192.168.1.102 and icmp' -k

For application layer capture filtering, the best you can do is by port:

sudo wireshark -f 'tcp port 80'

There is an http filter but only for as a wireshark display filter